Extract json fields

[falcon]

I have multiple fields under the interesting fields section named field1, field2, field3, and so on. Each of these fields contains a JSON key–value pair. I also have other fields that are already properly extracted and do not follow this field1, field2 pattern.

How can I extract values from these field1, field2, etc. fields? For example, if field1 contains {"username": "testUser"}, how can I filter for the value "testUser"? The raw data looks fine json logs. 

[gcusello]

Hi @falcon ,

at first use INDEXED_EXTRACTIONS = JSON in the sourcetype definition and then use, as @ITWhisperer said, the spath command (for more infos see at ( https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/9.0/search-commands/spath ).

Ciao.

Giuseppe

[PickleRick]

Wait.

1. Indexed extractions have nothing to do with spath command. And as I understand the question, only parts of the original event form json structures, not the whole raw event. In this case indexed extractions won't work anyway.

2. As a rule of thumb, indexed extractions shouldn't be used unless there is no other way.

[isoutamo]

It should works as already said. 

If it didn't work then maybe you have too long json event or it something like json but not exactly.

Please give some more information to us if needed.

[ITWhisperer]

You can use spath, for example:

| spath input=field1